Privacy notice

Who this notice is from

GuroOS is a personal teaching workspace for individual teachers. This notice explains what the service does with information you put into it, what it sends elsewhere, and what you can do about either.

It is written for the Philippine Data Privacy Act of 2012 (RA 10173) and its implementing rules. Where the Act uses the words: you are the data subject for your own account information; for the learner records you keep here, your school is ordinarily the personal information controller and GuroOS processes those records on your instruction.

The operator’s registered name, address and Data Protection Officer must appear here before this notice is published. They are not filled in yet.

What the workspace holds

Four kinds of information, and they are treated differently:

Your account

Name, email address, and the password digest or the identity your school’s sign-in provider returns. Optional professional details you choose to add — position, employee number, school, region, division, district, years of service.

Your teaching work

Subjects, curricula, competencies, lesson plans, worksheets, presentations, videos, assessments, rubrics, tables of specifications, tasks and notes. This is your work, and it is yours.

Learner records

Class lists, attendance registers, scores and gradebook entries, and any observation notes you write. These are children’s records and are handled with the extra care set out below.

Service records

Sign-in sessions, an audit trail of changes (who did what, to which record, from which request and IP address), AI usage counts, and billing records when you subscribe.

How learner names are handled with AI

This is the part worth reading closely, because it is where a teaching product most easily does something a teacher would not expect.

Learner names are replaced before anything reaches an AI provider. When a message, document or brief is sent for the assistant to work on, every learner from your own class lists who is named in it is substituted with a stable label — [Learner 1], [Learner 2] — and the names are put back in the reply before you read it. The provider sees the label, not the child.

A photograph cannot be de-identified, so it is gated instead. There is nothing textual in an image for the substitution to work on. Images are sent to a provider only where the operator has switched that on; where it is off, the assistant is told plainly that it cannot see the picture rather than being left to describe one it never received, and the attachment is labelled “Not sent to the assistant” in your workspace.

The assistant’s lookup tools return counts, never identities. When the assistant checks attendance or a gradebook mid-answer, what comes back is averages, tallies and your own labels for a class. No query behind those tools selects a learner’s name or an individual score.

Nothing generated is applied to your records on its own. Everything the assistant produces arrives as a draft with your review required before it is saved or used in class.

Why the information is processed

To run the workspace you asked for

Storing and returning your subjects, classes, materials and records; generating a draft when you ask for one; producing exports and printable documents.

To keep the account secure

Sessions, sign-in rate limits, password resets, email verification, and the audit trail — which exists so a change to a learner’s record always has a name and a time against it.

To bill a subscription

Only where you have taken one out, and only the plan, the amounts and the payment status.

To keep the service working

Error and performance logs. These record what failed and where, not the contents of a lesson or a learner’s marks.

Your teaching content is not used to train anyone’s AI model, is not sold, and is not shared with other teachers, your school, or anybody else unless you export it and share it yourself.

Who else touches it

A short list, and every entry is there because a feature needs it. Each receives only what that feature requires.

AI providers — OpenAI (ChatGPT) and Moonshot AI (Kimi)

Receive the text of your request, with learner names already replaced, and any document or image you attach subject to the rules above. Which provider answers depends on the operator’s configuration.

Brevo

Sends transactional email — verification, password reset, and account notices.

PayMongo

Processes subscription payments. Card details are entered on PayMongo’s own checkout and never reach GuroOS.

The operator’s hosting and identity infrastructure

Databases, object storage for your files, and Keycloak for sign-in — including Google sign-in, which is brokered through it rather than being a separate login of its own.

Some of these process data outside the Philippines. Where that happens the operator is responsible for the safeguards the Act requires of a cross-border transfer.

How long it is kept

Your workspace

For as long as the account exists. Nothing expires on its own while you are using it.

An attachment

Until you remove it or the account is erased. An upload that never finished being processed is swept within a day.

An export you download

Deleted from storage seven days after it is built.

Sessions, reset links and rate-limit records

Removed on a schedule once they can no longer authenticate or block anything — an expired reset link is still a digest of a credential, so it is not kept.

The audit trail and billing records

Kept longer than the rest, because they are the record of who changed a learner’s data and of what you were charged. They survive a deletion in reduced form and stop naming the account.

Your rights, and how to use them

The Act gives you rights over your own information. Here is what each one means in this product.

To be informed

This notice, and the plain statements in the product itself when something is about to leave it.

To access and to portability

Settings → Data and export builds a complete JSON copy of your workspace — profile, classes, curricula, materials, attendance and gradebook — and hands it to you.

To correct

Every record in the workspace is editable by you at any time.

To erasure

Your account and everything in it can be destroyed — the records, the documents, the files, and the sign-in identity. Because it cannot be undone, it needs proof that you are the one asking: your password, or a recent sign-in where your school holds the credential, plus a typed confirmation. Write to privacy@guro-os.com and it will be carried out.

To object, and to complain

Write to privacy@guro-os.com. You may also complain to the National Privacy Commission at privacy.gov.ph.

How it is protected

Passwords are stored as Argon2 digests and never in a form anyone can read back. Sessions are server-side and can be revoked. Files are held under a per-teacher prefix so that erasing an account erases its objects with it. Every write to a learner’s record is recorded in the audit trail.

No system is beyond compromise. If a breach affects your information, the operator will notify you and the National Privacy Commission within the period the Act requires.

Children

GuroOS is for teachers, and accounts are for adults. Learners do not sign in and have no account. Their records are here because you keep them here, in the same way a paper class record holds them — which is why the AI rules above are written the way they are.

Changes to this notice

When this notice changes materially, the effective date at the top changes with it and account holders are told by email before it takes effect.